CVE-2026-99169

What it actually does

FUT_OFF_MMSHARED futex waiters keyed only by MM address can receive wakeups intended for a different MM after address reuse, because a FUT_OFF_INODE waiter can be requeued onto a FUT_OFF_MMSHARED futex by another process.

Why it matters to the business

Multi-threaded applications that rely on futex-based synchronization may experience missed or spurious wakeups, leading to hangs, incorrect thread coordination, or unpredictable behavior in containerized or high-density Linux environments.

How an attack unfolds

An attacker with local access creates processes that requeue futex waiters from inode-based to MM-shared keys, then triggers MM reuse so that a waiter on a freed MM consumes a wakeup meant for a newly allocated MM at the same address; the unique 64-bit per-MM ID fix prevents this cross-MM wakeup misdelivery.

How to fix it

Apply the upstream kernel commit that keys FUT_OFF_MMSHARED futexes with a unique 64-bit per-MM identifier; rebuild and deploy the patched kernel, leaving private futex paths unchanged for performance.

How to confirm the fix worked

Confirm the patch is present by inspecting the futex keying logic for FUT_OFF_MMSHARED; run targeted futex requeue and MM reuse stress tests to verify no cross-MM wakeup leakage occurs.

Typical attack path

1. Obtain local unprivileged access on a Linux system
2. Create multiple processes and use futex requeue operations to move waiters onto FUT_OFF_MMSHARED keys
3. Force MM release and rapid reallocation to reuse the same virtual address
4. Deliver wakeups to the new MM while the old waiter is still blocked
5. Observe incorrect wakeup consumption or synchronization failure

How to detect it

Examine kernel logs and audit trails for unusual futex-related warnings or scheduler anomalies around process exit and MM reuse; no public exploit artifacts are known.

What your security team should do

• Prioritize kernel updates on multi-tenant and container hosts within the next patch cycle
• Monitor upstream stable branches for backports of the per-MM ID change
• Review any custom futex-using workloads for exposure to MM reuse patterns